> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/black-duck-hub-scanner-reference.md).

# Black Duck step configuration

You can scan your repositories and container images using [Black Duck Hub](https://sig-product-docs.synopsys.com/bundle/bd-hub/page/Welcome.html) and ingest the results into Harness STO.

### Important notes for running Black Duck Hub scans in STO <a href="#important-notes-for-running-black-duck-hub-scans-in-sto" id="important-notes-for-running-black-duck-hub-scans-in-sto"></a>

* **Container image scans:** Black Duck container scans require a [Docker-in-Docker background step](/security-testing-orchestration/use-sto/sto-scanner-configuration/security-step-settings-reference.md#configuring-docker-in-docker-dind-for-your-pipeline) when you run them on Kubernetes or Docker build infrastructures.
  * **DinD image:** Set the Background step image to `docker:24-dind`. Black Duck Detect Docker Inspector aligns its parser with Docker versions 20.0.x through 24.0.x. Go to [Supported image formats](https://docs.blackduck.com/r/detect/11.5.0/black-duck-detect/supported-image-formats.html) in the Black Duck Detect documentation to review image format requirements and Docker version compatibility.
  * **Tar file scans:** If you scan a local OCI or Docker archive (`.tar`), create the archive with Docker 24.0.x or another version in the 20.0.x through 24.0.x range.
* You can utilize custom STO scan images and pipelines to run scans as a non-root user. Go to [Configure your pipeline to use STO images from private registry](/security-testing-orchestration/3.0/troubleshooting-and-resources/sto-use-cases/set-up-sto-pipelines/configure-pipeline-to-use-sto-images-from-private-registry.md) for setup instructions.
* STO supports three different approaches for loading self-signed certificates. For more information, refer [Run STO scans with custom SSL certificates](/security-testing-orchestration/3.0/troubleshooting-and-resources/sto-use-cases/secure-sto-pipelines/ssl-setup-in-sto.md#supported-workflows-for-adding-custom-ssl-certificates).

### Black Duck Hub step settings for STO scans <a href="#black-duck-hub-step-settings-for-sto-scans" id="black-duck-hub-step-settings-for-sto-scans"></a>

The recommended workflow is to add a BlackDuck step to a Security or Build stage and then configure it as described below.

#### Scan <a href="#scan" id="scan"></a>

**Scan Mode**

**Scan Configuration**

#### Target <a href="#target" id="target"></a>

**Type**

**Target and Variant Detection**

**Name**

**Variant**

**Workspace**

#### Container image <a href="#container-image" id="container-image"></a>

**Type**

The registry type where the image is stored:

* **Docker v2** A registry that uses the Docker Registry v2 API such as [Docker Hub](https://docs.docker.com/registry/spec/api/), [Google Container Registry](https://cloud.google.com/container-registry), or [Google Artifact Registry](https://cloud.google.com/artifact-registry).
* [**AWS ECR**](https://aws.amazon.com/ecr/)
* [**Jfrog Artifactory**](https://jfrog.com/artifactory/)
* **Local Image in this Stage** Scan a local image built and stored within the context of the current stage (via `/var/run/docker.sock` registered as a stage level volume mount).
* **Local OCI/Docker archive in this Stage** Scan an OCI or Docker archive that has been created and stored within the current stage. The path to the archive can be specified via the workspace field, and ensure that the path to which the archive is saved is a shared volume mount.

**Domain (*****extraction*****)**

**Name**

**Tag/Digest**

#### Ingestion <a href="#ingestion" id="ingestion"></a>

**Ingestion File**

#### Authentication <a href="#authentication" id="authentication"></a>

**Domain**

**Enforce SSL**

**API Version**

**Type**

**Access Token**

#### Scan Tool <a href="#scan-tool" id="scan-tool"></a>

**Project Name**

**Project Version**

#### Log Level <a href="#log-level" id="log-level"></a>

#### Additional CLI flags <a href="#additional-cli-flags" id="additional-cli-flags"></a>

Use this field to run the [`synopsys detect` scanner](https://blackducksoftware.github.io/synopsys-detect) with flags such as:

`-detect.tools.excluded {DETECTOR, SIGNATURE}`

This string [excludes some detectors from a scan](https://community.synopsys.com/s/article/Allow-only-certain-Detect-tools-to-take-effect).

#### Fail on Severity <a href="#fail-on-severity" id="fail-on-severity"></a>

#### Settings <a href="#settings" id="settings"></a>

#### Additional Configuration <a href="#additional-configuration" id="additional-configuration"></a>

#### Advanced settings <a href="#advanced-settings" id="advanced-settings"></a>

### Proxy settings <a href="#proxy-settings" id="proxy-settings"></a>

### Troubleshooting Black Duck Hub <a href="#troubleshooting-black-duck-hub" id="troubleshooting-black-duck-hub"></a>

#### Scan fails with message "Could not connect to addon client after max retries" <a href="#scan-fails-with-message-could-not-connect-to-addon-client-after-max-retries" id="scan-fails-with-message-could-not-connect-to-addon-client-after-max-retries"></a>

This message indicates that indicates that the container running the BlackDuck scan step is terminated abruptly due to insufficient resources. Harness recommends that you increase the resource allocation using an iterative approach: Run the scan again with `memory: 1Gi` and `cpu: "1.0"`, monitor the results, and adjust the resource allocation until the scanner runs successfully.

For more information, go to [Optimize STO pipelines](/security-testing-orchestration/3.0/troubleshooting-and-resources/sto-use-cases/set-up-sto-pipelines/optimize-sto-pipelines.md).